Update package.json

set a winston version, 0.7 broke logs